Read the docs
TI-2021-08882 Aliases CVE-2021-27389GHSA-wrq7-4jj9-f6rc

A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS…

Priority MEDIUM 44CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-321.

Summary

A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key is shipped with the product without adequate protection.

Why it matters now

EPSS 0.0103 63rd percentileScored 2026-11-07
Fix Fixed Opcenter Quality (Siemens): V12.2QMS Automotive (Siemens): V12.30

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensOpcenter Qualitybefore V12.2V12.2Patch availableCNA
SiemensQMS Automotivebefore V12.30V12.30Patch availableCNA
  • Opcenter Quality VendorSiemens Affected before V12.2 Fixed in V12.2 Patch available CNA
  • QMS Automotive VendorSiemens Affected before V12.30 Fixed in V12.30 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:siemens:opcenter_quality:*:*:*:*:*:*:*:*before 12.2VulnerableSiemens
cpe:2.3:a:siemens:qms_automotive:*:*:*:*:*:*:*:*before 12.30VulnerableSiemens
  • cpe:2.3:a:siemens:opcenter_quality:*:*:*:*:*:*:*:* Versions before 12.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:qms_automotive:*:*:*:*:*:*:*:* Versions before 12.30 Vulnerable ·Siemens

Remediation

  • Fix · CNA Opcenter Quality (Siemens) Fixed in V12.2
  • Fix · CNA QMS Automotive (Siemens) Fixed in V12.30

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-27389
  2. 2026-10-03 Alias added: GHSA-wrq7-4jj9-f6rc

References

Advisory 1

  • TI-2023-24902 A vulnerability has been identified in Opcenter Execution Foundation (All versions <… CVSS 3.1HIGH 8.8
  • TI-2023-24906 Improper input validation in Siemens Opcenter Execution Foundation CVSS 3.1HIGH 7.5
  • TI-2023-24905 Buffer overflow in Siemens Opcenter Execution Foundation CVSS 3.1HIGH 7.5
  • TI-2020-06109 Uncontrolled resource consumption in Siemens Opcenter Execution Discrete CVSS 3.1HIGH 8.2
  • TI-2022-14854 Improper authentication in Siemens Opcenter Quality V13.1 CVSS 3.1HIGH 7.5
  • TI-2023-24904 Buffer overflow in Siemens Opcenter Execution Foundation CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences